CVE-2025-63914

CVE-2025-63914 Public disclosure and patch for CVE-2025-63914: Zip bomb vulnerability in Cinnamon/kotaemon. Credit Wang Yuanrong Summary The mayextractzip function fails to enforce limits on ZIP decompression, allowing a malicious ZIP bomb to trigger excessive resource consumption and denial of...

Debian dla-4876 : python-aiohttp-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4876 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4876-1 [email protected]...

[SECURITY] [DLA 4876-1] python-aiohttp security update

Debian LTS Advisory DLA-4876-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert October 31, 2026 https://wiki.debian.org/LTS Package : python-aiohttp Version : 3.8.4-1+deb12u2 CVE ID : CVE-2025-53643 CVE-2025-69223 CVE-2025-69224 CVE-2025-69225 CVE-2025-69226...

zip_bomb

ZIP Bomb Creator ZIP Bomb Creator is a tool used to create a ZIP file that is small in size but drastically expands when extracted. This is useful for security experiments and testing file systems against ZIP Bomb attacks. Features Create a ZIP Bomb with configurable file count and size. Supports...

wheelaudit

wheelaudit Python Wheel File Security Scanner — scan .whl files for security issues before installation. Motivated by recent CVEs in Python wheel handling: CVE-2026-24049 : Path traversal in wheel unpack allows permission manipulation of system files CVE-2026-1703 : Path traversal when pip instal...

CVE-2026-115503

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing...

EUVD-2026-108335

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing...

CVE-2026-115503

Ghidra versions prior to 12.2 are vulnerable to a Denial of Service attack due to improper handling of highly compressed data within the ExtensionUtils.unzipToInstallationFolder() function. An attacker can trick a user into installing a crafted zip bomb extension archive that expands without size...

CVE-2026-115503 Ghidra before 12.2 Denial of Service via Compressed Extension Archive

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing...

CVE-2026-115503 Ghidra before 12.2 Denial of Service via Compressed Extension Archive

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing...

National Security Agency Ghidra Software Reverse Engineering Framework Resource Management error vulnerability

Versions of the National Security Agency Ghidra Software Reverse Engineering Framework prior to 12.2 contain a resource management error vulnerability. This vulnerability stems from ExtensionUtils.unzipToInstallationFolder’s improper handling of highly compressed data. Attackers can trick users...

PT-2026-121577

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141781 advisory. An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to...

Zip Bomb DoS

Eclipse Vert.x is vulnerable to Zip Bomb DoS. The vulnerability is due to the WebSocket implementation not defining a maximum number of bytes allocation when decompressing frames or messages, where an attacker can send a crafted compressed payload a zip bomb that expands to a huge size and exhaus...

CVE-2026-102467

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...

CVE-2026-102467

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...

CVE-2026-102467

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...

EUVD-2026-101929

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...

CVE-2026-102467

The io.vertx:vertx-core component in Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0] contains a vulnerability in its WebSocket implementation . The root cause is a failure to define a maximum number of bytes allocation when decompressing frames or mess...

CVE-2026-102467

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. This can be used to implement DDOS attacks with a zip bomb. The impacted component is...